ESXi: esxi-8.network-bpdu

Information

Enable the Bridge Protocol Data Unit (BPDU) filter on the ESXi host. BPDUs (Bridge Protocol Data Units) are used to transmit Spanning Tree Protocol (STP) information and detect network loops. BPDU Guard and Portfast are commonly enabled on the physical switch directly connected to the ESXi host to reduce spanning tree convergence delay. However, if a BPDU packet is sent from a virtual machine on the ESXi host to the configured physical switch, it can result in a cascading lockout of all uplink interfaces from the ESXi host. To prevent this type of lockout, BPDU Filter can be enabled on the ESXi host to drop any BPDU packets being sent to the physical switch. It is important to note that Standard and Distributed Virtual Switches do not support STP and do not generate BPDUs.

Solution

Get-VMHost -Name $ESXi | Get-AdvancedSetting Net.BlockGuestBPDU | Set-AdvancedSetting -Value 1

See Also

https://github.com/vmware/vcf-security-and-compliance-guidelines/raw/refs/heads/main/security-configuration-hardening-guide/vsphere/8.0/